This deployment stores business data — products, customers, sales, invoices and accounting records — in the MySQL database you control. Nothing is sent to a third party unless you configure SMTP or the WhatsApp API yourself.
Secrets such as SMTP passwords and WhatsApp tokens are encrypted at rest with AES-256-GCM and are never rendered back in plain text.
Tax records are retained for at least five years, in line with UAE record-keeping requirements. Each tenant can export or request deletion of its own data.